@codex plan a way that this can be a compiler flag feature. I don't want to have this in a production build.

The current runtime-only --debug/RECOMMA_DEBUG switch (see cmd/recomma/main.go and cmd/recomma/internal/config/config.go) is always compiled into the binary, so the relaxed vault behaviour ships in production builds.

:::task-stub{title="Gate debug mode behind a build tag"}

1. Introduce a debugmode (name tbd) Go build tag: move the existing helpers in cmd/recomma/debug.go into a //go:build debugmode file and add a cmd/recomma/debug_disabled.go compiled when !debugmode is set that either panics at init or returns a sentinel error to callers.
2. Update main() in cmd/recomma/main.go so that, under !debugmode, it refuses to start if cfg.Debug is true (e.g., by checking a debugModeAvailable() helper defined per build tag) before calling loadDebugSecretsFromEnv.
3. Split the flag wiring in cmd/recomma/internal/config: provide a //go:build debugmode file that registers the --debug flag/env hook, and a //go:build !debugmode twin that hardcodes cfg.Debug = false plus marks the flag as hidden or errors out when set (using pflag.Flag.Value.Set inside a custom BoolVar wrapper).
4. Thread the build-tagged availability check into internal/api/handler.go and webui/embed.go so that the WithDebugMode option and webui.SetDebug receive false automatically when the feature is compiled out.
5. Extend docs/modules/ROOT/pages/debug-mode.adoc (and any other references in docs/modules/ROOT/nav.adoc) to explain the new go build -tags debugmode ./cmd/recomma requirement and warn that release builds omit the flag.
   :::

View task →

@codex review

Codex Review: Didn't find any major issues. Delightful!